CucumberStudio vs Veracode comparison

Read 208 Veracode reviews

27,682 Views
4,706 Comparison Views

89% willing to recommend

CucumberStudio

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between CucumberStudio and Veracode based on real PeerSpot user reviews.

Find out in this report how the two Dynamic Application Security Testing (DAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed CucumberStudio vs. Veracode Report (Updated: June 2026).

CucumberStudio vs. Veracode

June 2026

Download the complete report

Helped 909,725 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

CucumberStudio

Ranking in Dynamic Application Security Testing (DAST)

12th

Average Rating

8.0

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Rapid Application Development Software (25th)

Veracode

Ranking in Dynamic Application Security Testing (DAST)

1st

Average Rating

8.0

Reviews Sentiment

6.9

Number of Reviews

208

Ranking in other categories

Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Container Security (13th), Software Composition Analysis (SCA) (2nd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (2nd)

Mindshare comparison

As of August 2026, in the Dynamic Application Security Testing (DAST) category, the mindshare of CucumberStudio is 1.6%, up from 0.3% compared to the previous year. The mindshare of Veracode is 13.8%, down from 25.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Dynamic Application Security Testing (DAST) Mindshare Distribution
Product	Mindshare (%)
Veracode	13.8%
CucumberStudio	1.6%
Other	84.6%

Dynamic Application Security Testing (DAST)

Featured Reviews

Walter Wirch

Technical Expert at Bertelsmann SE & Co.

Facilitates integration of test scenarios while needing modernization of components

CucumberStudio is primarily used for designing test scenarios and automating testing. We have implemented it in conjunction with our own routines for integration into our infrastructure CucumberStudio aligns with our strategy for data-driven testing. It supports our product owners in designing…

Read full review

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

Integrates security into the development process and improves team collaboration

Veracode helps organizations develop software by reducing the risk of security vulnerabilities through developer enablement and applications focused on governance. You can utilize different levels of processes to achieve better performance or a more scalable service. Since I started working with it in 2022, I’ve found it to be cost-effective as well. Overall, Veracode is a user-friendly security tool. It includes features such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA). During the development phase, we can identify vulnerabilities in the application. This process occurs in the staging environment during development. When we're ready to go to production, we conduct a final check. Essentially, this tool helps identify vulnerabilities during the code development stage, including both high-level vulnerabilities and those related to open-source software composition. We utilize specific methodologies for this purpose. Additionally, it offers a feature that allows us to set up policies based on client requirements. This means we can customize the tool to meet the specific needs of our clients, ensuring that they receive the appropriate level of security in their applications. Veracode is user-friendly as well. Compared to other tools, their scans take 15 minutes or under. If you have a large scale of libraries or data, it might take longer, but based on my personal experience, the scan usually runs within fifteen minutes. For my case study using the Veracode tool, I worked on an internal project following industry standards. We used Veracode to improve our security posture and speed up the time to market by streamlining the development process. This enhanced collaboration between developers, operations, and security teams. The automated scanning process helped identify and fix vulnerabilities earlier in the development process. We maintained compliance with regulatory requirements, avoided fines, and built customer trust by integrating security into the development process. When we conduct this scan, we receive data on a list of vulnerabilities. This information improved our communication and increased transparency, which leads to better reports about the efforts being put in. This results in a more effective and efficient collaboration process, making it user-friendly for all involved. When considering costs, if we resort to manual processes, it can be time-consuming. Therefore, we utilize automated scans to identify and fix security issues. This allows us to address vulnerabilities early in the development process, as we discussed previously. This applies both to our in-house code and third-party libraries, using Software Composition Analysis (SCA) agent-based scans. In the future, we will also implement SCA agent-based scans as a separate feature within Veracode, which can help organizations avoid the expensive and time-consuming consequences of security issues. Furthermore, we have seen an increase in compliance, helping to maintain adherence to regulatory requirements and industry standards, thereby avoiding fines and reputational damage associated with noncompliance. Additionally, by integrating security into the development process, we enhance customer trust in our organization and its products.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature is the re-usability of action words."

"Scenarios, since is a really easy way to create and control your test cases."

"CucumberStudio aligns with our strategy for data-driven testing."

"Hiptest allowed us to clean up our test campaigns and standardize the way we write test cases and structure our BDD approach."

"The URL is very useful, and it has a very good UI for deploying information of the scenarios created."

"CucumberStudio has a very user-friendly interface."

"The solution is stable."

"The best thing is that a person without knowledge about the program can easily understand what happened in our testing process."

More CucumberStudio pros

"It is a cloud-based platform, so every organization or every security team in the organization is concerned about uploading their code because ultimately the code is intellectual property. The most useful thing about Veracode is that if you want to upload the code, they accept only byte code. They do not accept the plain source code as an input. The code is converted into binary code, and it is uploaded to Veracode. So, it is quite secure. It also has the automation feature where you can integrate security during the initial stages of your software development life cycle. It is pretty much easy with Veracode. Veracode provides integration with multiple tools and platforms, such as Visual Studio, Java, and Eclipse. Developers can integrate with those tools by using Jenkins. The security consultation or the support that they provide is also really good. Its user management is also good. You can restrict the users for a particular application so that only certain developers will be able to see the code that has been scanned. Their reporting model is really good. For each customer, they provide a program manager. Every quarter, they have their reviews about how much it has scanned. They also ensure that the tool has been used efficiently."

"The policy reporting for ensuring compliance with industry standards and regulations is pretty comprehensive, especially around PCI. If you do the static analysis, the dynamic analysis, and then a manual penetration test, it aggregates all of these results into one report. And then they create a PCI-specific report around it which helps to illustrate how the application adheres to different standards."

"One of the features they have is Software Composition Analysis. When organizations use third-party, open source libraries with their application development, because they're open source they quite often have a lot of bugs. There are always patches coming out for those open source applications. You really have to stay on your toes and keep up with any third-party libraries that might be integrated into your application. Veracode's Software Composition Analysis scans those libraries and we find that very valuable."

"It allows us to prove our security levels to vendors, and additionally helps us with our HIPAA security policies."

"It is great to have such insight into code without having to upload the source code at all. It saves a lot of NDA paperwork. The Visual Studio plugin allows the developer to seamlessly upload the code and get results as he works, with no manual upload. The code review function is great. It allows you to find flaws in source code."

"Using an automated tool brings cost reduction and more security."

"The integrated IDE tool enables users to get instant feedback in real-time on the code itself, rather than waiting for it to go through the CI/CD pipeline and get the result."

"Provides the ability to understand the black zones in our system."

More Veracode pros

Cons

"More tutorials and examples."

"Yes, it is not stable when you create a data table that includes more than 30 elements, so it can lose your data."

"Copy-pasting something directly from JIRA requires too much modification and formatting."

"CucumberStudio's API integration could be improved both in terms of reliability and design."

"I think it would be better if we could also do the reporting with CucumberStudio."

"The reporting and metrics can be improved. E.g.: If we wanted to have metrics across all projects."

"A key area for improvement is to revamp outdated components such as HipTest publisher."

"The reporting needs to be improved."

More CucumberStudio cons

"If the dynamic scan is improved, then the speed might go up. That is somehow not happening. We have raised this concern. It might also help if they could time limit scans to 24 hours instead of letting them go for three days. Then, whatever results could be shared, even if the scan is not complete, that would definitely help us."

"The ideal situation in terms of putting the results in front of the developers would be with Veracode integration into the developer environment (IDE). They do have a plugin, which we've used in the past, but we were not as positive about it."

"The solution should include monthly guidelines, a calendar, or a newsletter highlighting the top vulnerabilities and how to resolve them using Veracode. Its policies should be up-to-date with NIST standards and OWASP policies."

"There are certain shortcomings in Veracode's static analysis engine. I would improve Veracode's static analysis engine to make it capable of identifying vulnerabilities with low false positives."

"I would also like to see some improvement in the speed. Our developers are saying, "It takes 72 hours to scan it.""

"The security labs integration has room for improvement."

"One feature I would like would be more selectivity in email alerts. While I like getting these, I would like to be able to be more granular in which ones I receive."

"It takes a while to get a response to the software composition analysis. It is within an acceptable range but it could still be improved."

More Veracode cons

Pricing and Cost Advice

Information not available

"I'm unfamiliar with the solution's pricing, but it must be worth the cost from a company perspective, as we have been using it for years and have no plans to move away from it."

"Veracode is one of the more expensive solutions in the market, but it is worth the expense because of the eLearning and the security consultations; everything is included in the license."

"We're very comfortable with their model. We think they're a good value. We worked very closely with Veracode on understanding their license model, understanding what comprises the fee and what does not. With their assistance in design, we decomposed our application in a way where we are scanning a very significant amount of code without wasting their capacity and generating redundant reported issues. You scan in profiles, per se. And we work with them, in their offices, to design the most effective approach. So the advice I would have for customers is, you can get up and live fast, but work closely with Veracode to refine the method you use for scanning and the way you compile the applications. There's a concept called entry-point scanning, and that's probably not used well by the rest of their customers. We see our licensing as a good value because we leverage it heavily."

"The pricing is fair. You get a lot out of the product."

"Regarding licensing, pay very close attention to what applications you're going to need to do dynamic scanning for, versus static. Right now, the way the licensing is set up, if you don't have any static elements for a website, you can certainly avoid some costs by doing more dynamic licenses. You need to pay very close attention to that, because if you find out later that you have static code elements - like Java scripts, etc. - that you want to have scanned statically, having the two licenses bundled together will actually save you money."

"Negotiate some, but their prices are reasonable."

"The pricing is fair."

"Veracode is affordable for large organizations, but its pricing may be out of reach for small and medium companies."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.

See recommendations

909,725 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

16%

Construction Company

16%

Comms Service Provider

12%

Financial Services Firm

11%

Financial Services Firm

15%

Manufacturing Company

11%

Computer Software Company

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	3
Large Enterprise	4

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	46
Large Enterprise	114

Questions from the Community

What needs improvement with Hiptest?

CucumberStudio's API integration could be improved both in terms of reliability and design. The API requires data to be sent in a specific format, which takes time to build. Additionally, the repor...

What is your primary use case for Hiptest?

I use CucumberStudio as a test case repository. All of our test cases are stored there. It is also part of our test planning process. For every sprint, we plan the test cases in CucumberStudio and ...

What advice do you have for others considering Hiptest?

For teams following a BDD style software development approach, CucumberStudio is a great collaborative tool that covers all the basic requirements of a test management tool. I would rate CucumberSt...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

Aikido Security vs CucumberStudio

Comparisons

Compared 16% of the time

GitHub CoPilot vs CucumberStudio

Compared 13% of the time

IBM Cloud Pak for Applications vs CucumberStudio

Compared 12% of the time

Continuous Dynamic (formerly WhiteHat Dynamic) vs CucumberStudio

Compared 7% of the time

SmartBear TestComplete vs CucumberStudio

Compared 7% of the time

More CucumberStudio Competitors

Checkmarx One vs Veracode

Compared 5% of the time

SonarQube vs Veracode

Compared 5% of the time

Invicti vs Veracode

Compared 3% of the time

HCL AppScan vs Veracode

Compared 3% of the time

GitLab vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Rapid Application Development Software

August 2026

Download CucumberStudio product report

Download Veracode product report

July 2026

Also Known As

Hiptest

Crashtest Security , Veracode Detect

Overview

CucumberStudio enhances software testing with BDD-style Gherkin syntax, supporting code integration and data-driven testing, streamlining test management for agile teams.

CucumberStudio facilitates effective test management through robust features, promoting re-usability of action words and seamless third-party collaborations. It integrates smoothly with JIRA and other frameworks, simplifying processes with its intuitive interface. Scenarios and test runs boost testing speed and execution efficiency. However, improvements in JIRA conversion, API integration, and reporting are needed, alongside enhanced support for global users and expanded deployment options. Users find the framework beneficial for tracking user stories with comprehensive test coverage while automating scenarios for mobile and software applications. Planning and documenting tests become seamless as it aligns with project management tools.

What are the standout features?

Re-usability of Action Words: Streamlines test creation by using pre-defined actions across scenarios.
Data Tables: Facilitates efficient data handling for comprehensive testing.
Code Integrations: Ensures seamless connections with existing codebases and APIs.
BDD-Style Gherkin Syntax: Enhances clarity and management of tests.
Unlimited Read-Only Accounts: Allows widespread access for engineers and managers without additional costs.
Integration with JIRA: Links testing processes with project tracking tools for efficient management.
Data-Driven Testing Support: Strengthens the testing process by using varied datasets.

Why consider CucumberStudio for testing?

Enhanced Productivity: User-friendly interface and robust features streamline test management.
Improved Collaboration: Seamless integration with third-party tools promotes teamwork.
Accelerated Testing: Scenarios and test runs enable faster execution and feedback loops.
Cost-Effective Access: Unlimited read-only accounts maximize participation without extra expense.
Comprehensive Coverage: Supports behavior-driven development for thorough testing.

CucumberStudio is widely applied for tracking user stories and ensuring aligned test coverage in industries utilizing BDD frameworks. It facilitates seamless automation of test scenarios within mobile and software development, fostering efficient integration with infrastructure routines, thus supporting comprehensive project management and execution.

SmartBear

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Cisco, Cardinal Health, Intuit, Smartbox, Accenture, Deliveroo

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.